Fix test_callout to dispatch via filter's bound calloutKey + add bind_ipv6 helper#307
Open
mikeagun wants to merge 1 commit into
Open
Fix test_callout to dispatch via filter's bound calloutKey + add bind_ipv6 helper#307mikeagun wants to merge 1 commit into
mikeagun wants to merge 1 commit into
Conversation
usersim's test_callout() was looking up the callout by layer alone (get_callout_key_from_layer_guid_under_lock), which returned the first callout registered at that layer. This was incorrect: each WFP filter is bound to a specific calloutKey, and real WFP dispatches to that specific callout. The previous behavior was non-deterministic when multiple callouts shared a WFP layer. Use fwpm_filter->action.calloutKey instead — it's already captured during add_fwpm_filter(). This matches real WFP behavior and enables testing of multi-callout-per-layer scenarios (e.g., legacy bind hook coexisting with sock_addr-aligned bind hook at FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4). Also add usersim_fwp_bind_ipv6() and populate compartment_id / interface_luid / user_id in the bind classify parameters (fields that the legacy bind callback ignores but are needed for sock_addr bind context population).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add support for multiple callouts per layer, add IPv6 bind callout, and populate additional bind callout fields.
Problem
fwp_engine_t::test_callout() looks up the callout by layer alone via get_callout_key_from_layer_guid_under_lock(), which returns the first fwpm_callouts entry matching the layer.
Fix
Look up the callout via the filter's bound action.calloutKey instead of scanning by layer:
For tests with one callout per layer (today's status quo) the behavior is identical. For tests with multiple callouts per layer it now matches real WFP.
Additional changes (related, small).
Motivation. This surfaced while adding a BPF_PROG_TYPE_CGROUP_SOCK_ADDR bind hook (BPF_CGROUP_INET4/6_BIND) to eBPF for Windows, which coexists with the existing legacy bind hook at FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4/V6. Without this fix, unit tests can't reliably target one callout vs. the other when both are registered.